CVE-2024-53849
Several stack buffer overflows and pointer overflows in editorconfig-core-c
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Several stack buffer overflows and pointer overflows in editorconfig-core-c
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-53849- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-121
- Updated
- 2026-11-02
EUVDEUVD-2024-52173
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-52173- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-53849- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-121
- Updated
- 2026-11-02
OSV
Several stack buffer overflows and pointer overflows in editorconfig-core-c
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-53849- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-121
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-53849
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
DEBIAN-CVE-2024-53849- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-53849
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
UBUNTU-CVE-2024-53849- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVSUSE-SU-2024:4152-1 No score
Security update for editorconfig-core-c
This update for editorconfig-core-c fixes the following issues:
- CVE-2024-53849: stack buffer overflow and pointer overflow when handling escaped characters. (bsc#1233815)
- Record
SUSE-SU-2024:4152-1- Updated
- 2026-11-02
OSVUSN-7168-1 No score
editorconfig-core vulnerabilities
It was discovered that EditorConfig improperly managed memory when handling certain inputs, leading to overflows. An attacker could possibly use these issues to cause a denial of service, or execute arbitrary code.
- Record
USN-7168-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
editorconfig-coreDebian:12 |
All versions, plus listed versions 0.12.10+~0.17.1-10.12.10+~0.17.1-20.12.10+~0.17.1-30.12.6-0.10.12.7-0.10.12.9+~0.15.1-10.12.9+~0.17.1-10.12.9+~0.17.1-2 |
None known |
editorconfig-coreDebian:13 |
before 0.12.7-0.1 | 0.12.7-0.1 |
editorconfig-coreDebian:14 |
before 0.12.7-0.1 | 0.12.7-0.1 |
editorconfig-coreDebian:11 From an advisory covering 2 CVEs |
before 0.12.1-1.1+deb11u1, plus listed versions 0.12.1-1.1 |
0.12.1-1.1+deb11u1 |
editorconfig-core-cSUSE:Linux Enterprise Module for Development Tools 15 SP6 |
before 0.12.6-150600.3.3.1 | 0.12.6-150600.3.3.1 |
editorconfig-core-copenSUSE:Leap 15.6 |
before 0.12.6-150600.3.3.1 | 0.12.6-150600.3.3.1 |
editorconfig-coreUbuntu:Pro:16.04:LTS |
before 0.12.0-2ubuntu0.1~esm2, plus listed versions 0.12.0-20.12.0-2ubuntu0.1~esm1 |
0.12.0-2ubuntu0.1~esm2 |
editorconfig-coreUbuntu:Pro:18.04:LTS |
before 0.12.1-1.1ubuntu0.18.04.1~esm2, plus listed versions 0.12.1-10.12.1-1.10.12.1-1.1ubuntu0.18.04.1~esm1 |
0.12.1-1.1ubuntu0.18.04.1~esm2 |
editorconfig-coreUbuntu:20.04:LTS |
before 0.12.1-1.1+deb11u1build0.20.04.1, plus listed versions 0.12.1-1.1 |
0.12.1-1.1+deb11u1build0.20.04.1 |
editorconfig-coreUbuntu:Pro:22.04:LTS |
before 0.12.5-2ubuntu0.1~esm2, plus listed versions 0.12.1-1.10.12.1-20.12.5-20.12.5-2ubuntu0.1~esm1 |
0.12.5-2ubuntu0.1~esm2 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
editorconfig-coreUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 0.12.0-2ubuntu0.1~esm2, plus listed versions 0.12.0-20.12.0-2ubuntu0.1~esm1 |
0.12.0-2ubuntu0.1~esm2 |
editorconfig-coreUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 0.12.1-1.1ubuntu0.18.04.1~esm2, plus listed versions 0.12.1-10.12.1-1.10.12.1-1.1ubuntu0.18.04.1~esm1 |
0.12.1-1.1ubuntu0.18.04.1~esm2 |
editorconfig-coreUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 0.12.1-1.1+deb11u1build0.20.04.1, plus listed versions 0.12.1-1.1 |
0.12.1-1.1+deb11u1build0.20.04.1 |
editorconfig-coreUbuntu:Pro:22.04:LTS From an advisory covering 2 CVEs |
before 0.12.5-2ubuntu0.1~esm2, plus listed versions 0.12.1-1.10.12.1-20.12.5-20.12.5-2ubuntu0.1~esm1 |
0.12.5-2ubuntu0.1~esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-53849 is a medium vulnerability (CVSS 4.8) in Editorconfig, published November 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in editorconfig-core 0.12.7-0.1.
References
github.com/editorconfig/editorconfig-core-c/security/advisories/GHSA-475j-wc37-6274
editorconfig.org
lists.debian.org/debian-lts-announce/2024/11/msg00036.html
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-53849
security-tracker.debian.org/tracker/CVE-2024-53849
suse.com/support/update/announcement/2024/suse-su-20244152-1
bugzilla.suse.com/1233815
ubuntu.com/security/CVE-2024-53849
cve.org/CVERecord?id=CVE-2024-53849